Service Mesh Platform · View 08 of 31 · 3 · Structure
Decisions
- Mesh control and identity run on a dedicated platform node pool with its own capacity reservation. A noisy tenant cannot starve istiod or the SPIRE server.
- Every cluster has its own istiod and its own SPIRE server. That per-cluster split is how the control plane is sharded: no replica ever holds more than one cluster's 2,000 proxy connections.
- The sidecar is a Kubernetes native sidecar (an init container that keeps running). The kubelet starts it before the app and stops it after, which removes the startup and shutdown races sidecars used to have.
Targets
- istiod: three replicas across three rooms, any one sufficient for the cluster. SPIRE server: three replicas on a CloudNativePG datastore with a synchronous standby.
Risks
- The SPIRE datastore is the one stateful component per cluster. It is backed up nightly and can be rebuilt from scratch in about an hour, because registration entries are derived from Kubernetes objects.
